# Privacy Policy — BarahGashta
**Last updated:** August 29, 2026
BarahGashta ("the App," "we," "us") is a casual multiplayer board game published by Nagabrahmam Upputuri. This policy explains what information the App collects, how it is used, who it is shared with, and the choices you have. The App is intended for a general audience and is not directed at children under 13.
**The App does not involve real money.** There are no purchases, no deposits, no withdrawals, and no cash prizes. "Coins" are a play-only score that exists solely inside the game. Coins cannot be bought, sold, transferred out of the game, redeemed, or exchanged for money or anything of value. Match stakes ("wagers") move coins between players inside a match and have no monetary value of any kind.
---
## 1. Playing as a Guest (no account)
**You can play the entire game without an account.** You are not required to sign in, and as a guest you are never asked for your real name, email address, phone number, contacts, or location.
When you first launch the App, it generates and stores the following **on your device**:
- A guest display name (e.g. "Guest_12345"), which you may change
- Your chosen avatar icon and token colour
- A randomly generated player identifier — a random value created on your device that does not contain or derive from any personal information. It keeps your progress and leaderboard entries associated with you across sessions.
- In-game progress: coins, XP, win streak, games played and won, daily-reward claim history, sound preference, and whether you have completed the tutorial
Apart from the specific cases described below, guest data stays on your device. It is not linked to your real identity. Uninstalling the App or clearing its storage deletes it permanently.
## 2. Signing in with Google (optional)
The App offers an **optional** Google sign-in, used to secure your leaderboard identity, back your progress up to the cloud, and enable staked matches. You do not have to sign in to play.
If you choose to sign in, authentication is handled by **Supabase Auth** and we receive from your Google account:
- Your **email address**
- Your **name** as it appears on your Google account
- Your **Google profile photo** (stored as a link to the image)
- A Supabase-issued account identifier
We do **not** receive your Google password, your contacts, your Google Drive contents, or any other Google data. Sign-in opens in a real browser tab (Chrome Custom Tabs) rather than inside the App, so your credentials are entered with Google directly and are never visible to the App.
Once signed in, the following is stored in our Supabase database against your account:
- **Account record** — your email address, name and profile photo link, held by Supabase Auth
- **Leaderboard record** — your display name, avatar, lifetime coins earned in public online matches, matches played, matches won, and XP
- **Cloud-saved progress** — your in-game profile (XP, streak, statistics, daily-reward history and preferences) so it survives reinstalling the App or switching devices
- **Coin balance and transaction history** — your coin balance and an append-only log of every change to it (daily rewards, rewarded-ad grants, match payouts, match stakes), each with a timestamp and reason
- **Daily rewarded-ad counter** — the number of reward videos watched today, used to enforce the daily limit
- **Guest-import record** — if you import a guest coin balance into your account, we record the device identifier and amount once, so the same balance cannot be imported twice
## 3. Online Multiplayer
When you play an online match, your device connects to our game server (hosted on **Railway**) over an encrypted WebSocket connection to synchronise gameplay in real time. During an active match, the following is shared with the server and visible to the other players in that match:
- Your display name and chosen avatar
- Your player identifier
- Gameplay actions: dice rolls, token moves, ready and connection status, chosen stake, and any emoji reactions you send
Other players never see your email address. Live match state is held in the server's memory and discarded when the match ends or the room closes.
**Offline and local modes** — matches against the computer, pass-and-play local matches, and the tutorial run entirely on your device and send nothing to our servers.
## 4. Leaderboard and Match Records
When an online match finishes, our server records the result so leaderboard standings can be calculated. This record is stored in our **Supabase** database and contains:
- Your player identifier (your account identifier if signed in, otherwise the random guest identifier)
- Your display name and avatar at the time of the match
- Coins earned in that match, your finishing place, and the number of players at the table
- An identifier for the match and how it ended
These records are written by our server, not by your device, so standings cannot be altered by a modified copy of the game.
## 5. Advertising
The App displays advertisements supplied by **Google AdMob**. Ads appear between matches (full-screen), as an optional banner during play, and as an opt-in "watch a video for coins" reward video that only ever plays when you choose to start it.
To serve ads, Google may collect and process:
- Your device's **advertising identifier** (Android Advertising ID)
- Device and network information, including approximate location inferred from your IP address
- Ad interaction data — which ads were shown, viewed, or clicked
This data is collected by Google under its own privacy policy, not by us, and may be used to serve personalised advertising. We do not receive your advertising identifier and we do not sell your data.
**Your choices:**
- Where required by law (for example in the EEA, the UK and Switzerland), the App shows Google's consent form the first time ads are prepared, and your choice is respected. If you do not consent to personalised ads, the App requests **non-personalised ads** instead.
- You can reset or delete your advertising identifier at any time in **Android Settings → Privacy → Ads**, where you can also opt out of ad personalisation entirely.
- Google's practices are described at https://policies.google.com/technologies/ads and you can review partner details at https://policies.google.com/technologies/partner-sites.
## 6. Analytics
The App uses **GameAnalytics** (gameanalytics.com), a third-party analytics service, to understand how the game is played so we can improve it.
What is sent:
- Anonymous gameplay events — which screens are reached and which steps of the game flow are completed (for example: menu opened, match started, first move made, match ended)
- A randomly generated identifier created on first launch and stored on your device, so repeat sessions from the same installation can be counted as one player. It is not your advertising ID, it is not linked to your account, and it cannot be used to identify you personally. Clearing the App's storage or uninstalling the App discards it.
- Basic technical context: session identifiers, your device model, operating system and browser version, and the country inferred from your IP address
What is **not** sent: your name, email address, contacts, precise location, or any text you enter. We do not send crash logs or diagnostic reports. We do not sell this data or share it for advertising. GameAnalytics processes it on our behalf under their own privacy policy.
## 7. How We Use Your Information
We use the information described above only to:
- Run the game and synchronise online matches between players
- Maintain leaderboards and award coins fairly, and prevent cheating or duplicate awards
- Save and restore your progress if you sign in
- Display advertising, which is how the App is funded
- Understand how the game is played so we can improve it
We do **not** sell your personal information, and we do not share it with third parties for their own marketing purposes.
## 8. Legal Bases (EEA / UK users)
Where the UK GDPR or EU GDPR applies, we rely on: **contract** (running the game, multiplayer, leaderboards and your saved progress), **consent** (personalised advertising, gathered through Google's consent form, which you may withdraw at any time), and **legitimate interests** (analytics, security, and preventing abuse of the coin economy).
## 9. Data Retention and Deletion
**On your device** — your guest profile and progress persist until you clear the App's storage or uninstall it. Uninstalling removes all locally stored data, including your player identifier.
**Guest leaderboard records** — retained so standings remain meaningful over time. Because they are keyed to a random identifier rather than an account, please include your player identifier and display name when requesting deletion so we can locate them. Note that deleting the App removes that identifier, so if you intend to request deletion, do so before uninstalling.
**Account data** — if you sign in, your account record, leaderboard entry, cloud-saved progress, coin balance and transaction history are retained until you ask us to delete them.
**To delete your account and associated data**, email **nagabrahmamupputuri@gmail.com** from the email address you signed in with, with the subject "Delete my BarahGashta data". We will verify the request and delete your account record, leaderboard entry, cloud-saved progress, coin balance and transaction history within **30 days**. Deletion is permanent and your coins and progress cannot be recovered afterwards. You may also request deletion of specific data rather than your whole account.
Depending on where you live, you may also have the right to access, correct, or export your data, to object to or restrict processing, and to complain to your local data protection authority. Contact us at the address above to exercise any of these rights.
## 10. Children's Privacy
The App is not directed at children under 13 and we do not knowingly collect personal information from children. It is not enrolled in the Google Play Families programme. If you believe a child has provided us with personal information, contact us and we will delete it.
## 11. Security
Data in transit between the App, our game server and our database is encrypted using TLS. Access to our database is restricted by row-level security policies, and leaderboard and coin balances can be written only by our server — never directly by a copy of the game. No system is perfectly secure, but we take reasonable measures to protect your information.
## 12. Third-Party Services
| Service | Role | Their privacy policy |
|---|---|---|
| **Google AdMob** | Serves the advertising described in section 5 | https://policies.google.com/privacy |
| **Supabase** | Hosts our database and handles Google sign-in | https://supabase.com/privacy |
| **Railway** | Hosts our multiplayer game server | https://railway.app/legal/privacy |
| **GameAnalytics** | Receives the anonymous analytics in section 6 | https://gameanalytics.com/privacy |
Our servers and databases are located outside your country of residence, and your information may be transferred to and processed in those locations.
## 13. Changes to This Policy
We may update this policy as the App changes. Material changes will be reflected here with an updated "Last updated" date, and where required by law we will seek your consent again.
## 14. Contact
Questions, data access requests and deletion requests can be sent to:
**Nagabrahmam Upputuri**
**nagabrahmamupputuri@gmail.com**